CIS-EM: Certified Implementation Specialist - Event ManagementDemo

In ServiceNow Event Management, Severity is mandatory. An event with a blank severity can fail processing and receive the Error state.

ServiceNow Event Management event connectors use a default event-collection schedule of 120 seconds, which determines how often the system checks the connected event source for new events.

A URL that opens a web search using alert-field values is configured as a browser/application launch action in the Launch Applications area of an Event Management alert management rule. ServiceNow documents that this area is used to add instructions for launching applications or opening browser windows and can compose URLs from alert data.

MID Web Server Basic authentication requires the Basic Auth User and Basic Auth User Password configured for the extension. If that password is invalid, authentication fails and raw metric data cannot be pushed to the MID Server. A secret key in an authorization header is used for key-based authentication, not Basic authentication.

Alert flapping is repeated switching between active and resolved states, commonly when a monitored value repeatedly crosses an alert threshold. AWS documentation describes flapping alerts as causing frequent state changes and a firing–resolved–firing sequence.

A ServiceNow MID Server communicates securely with its ServiceNow instance over HTTPS using outbound TCP port 443; it does not require inbound connections for that communication.

Automated alert grouping creates a virtual alert as the group’s primary alert. ServiceNow displays the Feedback field only when an alert is a parent alert, where it records whether the alert group is accurate and useful.

ServiceNow Event Management supports only String values in Additional information JSON; numeric values must be converted to strings by enclosing them in double quotes. Therefore, a CPU value of 100 must be represented as the string "100".

ServiceNow tag-based alert clustering uses alert clustering definitions to define the filtering, grouping criteria, and timeframe, and alert clustering tags to specify the alert-field matching criteria. Tags are associated with definitions to determine which alerts are grouped.

Operational Intelligence anomaly alerts are available for analysis in Insights Explorer. They appear in Alert Intelligence only after being promoted to IT alerts, which makes them part of the IT-alert workflow.

Event field mappings map source-specific event values to Event Management target values. Their transform value pairs format incoming event data into the standardized values used by Event Management before alerts are generated.

ServiceNow applications are built on a shared platform data model and code base, allowing related records to be consistently used across products and workflows. The platform uses multiple related tables, including extensible parent-child tables, rather than placing every data element in one table.

Guided Setup provides a visual, guided implementation experience with out-of-box proven practices and setup tasks, accelerating configuration and time to value for ServiceNow capabilities.

A ServiceNow Event Management event with severity 0 (Clear) closes existing corresponding alerts. An event whose resolution state is Closing also closes corresponding alerts. OK severity creates an alert rather than closing one, and Clear is not the documented resolution-state value for closure.

ServiceNow alert priority combines weighted factors into an alert-priority score; alerts with higher priority are brought to the top for triage. A score of 4,406,020.001 is higher than 3,306,020.001 and 3,106,020.001, so it has the highest processing priority.

Event Management license usage is calculated from unique nodes that send event information to the instance, directly or through third-party monitoring tools. When alerts are bound to CIs, those bound CIs are used in the license-usage calculation; it is not based on connector or listener counts, nor on every CI being monitored.

For Event Management latency, the Process Events scheduled jobs must be operational; jobs in a Queued or Error state should be reset to Ready. Large-scale Event Management deployments also use multiple scheduled event-processing jobs to increase processing throughput. The Bucket field must be greater than zero, and multi-node event processing should be enabled rather than disabled.

An alert is a notification generated to draw attention to a significant condition or event detected through monitoring. An event is the underlying observable occurrence or change of state, rather than the notification about it.

Agent Client Collector uses the Sensu framework, enabling use and extension of monitoring checks from the community.

Approval requests governing execution of alert remediation tasks are configured in the Approvals related list of the alert management rule. Alert management rules define the response to an alert, including launching remediation actions.

Enrich automation adds contextual, meaningful information to incoming event data, making alerts more informative and actionable. It can standardize raw monitoring data to support later alert grouping and response, rather than creating alerts or administering team permissions.

ServiceNow alert management rules can execute remediation subflows, apply remediation workflows, and launch configured applications or browser targets. Business-rule evaluation and service-catalog request creation are not alert-management action types.

Now Assist for ITOM uses generative AI and a large language model (LLM) to generate human-readable alert titles, descriptions, and technical analysis from enriched alert data.

A pull connector instance should be tested to verify that the MID Server can connect to the external event source. Once that test succeeds, the connector instance must be activated so that it can begin collecting events.